Privacy Notice

Draft for review. This text is a template and has not been reviewed by counsel. Complete every [bracketed] item before real clients use this portal.

Who we are

This portal is operated by [firm legal name] (“we”). You can reach us at [privacy contact email or address].

Information we collect

Account information (your name, sign-in name and a password stored only as a salted hash); the documents and financial or tax information you or your accountant upload; and sign-in and activity records, such as the time of each sign-in.

How we use it

To provide accounting, bookkeeping, payroll and tax services; to keep the portal secure; to keep records we are required to keep; and to communicate with you about your engagement. [Add any other uses.]

AI assistants

The portal includes AI assistants that look up records and draft entries, messages and responses. They run on the firm's own computer using an open-source model; client information is not sent to an outside AI company and is not used to train models. The assistants only see identity and account numbers in a masked form (the last four digits). A person at the firm reviews and approves client-facing output before it is sent. [Confirm every statement in this section is still true for your setup before publishing.]

Sharing

We share information only with service providers who help us run the portal and services, and where the law requires. [List categories of providers.] We do not sell personal information.

Security

Access requires an account created by an administrator, protected by a strong password and two-step sign-in. Records and documents are encrypted where they are stored, connections are encrypted, identity and account numbers are masked on screen, each person can open only the areas they need, sessions end automatically after inactivity, and access to records and documents is logged. Backups are encrypted or kept on encrypted drives. The portal loads its fonts and other resources from its own server and does not send your information to advertising or analytics companies. [Confirm each statement applies to your setup; no system is completely secure.]

Retention

We keep records for [retention period] or as required by law, and then delete or anonymize them.

Your choices

You can ask us to access, correct or delete your information, subject to record-keeping obligations. Contact [privacy contact email or address].

Changes

We will update this notice when our practices change and show the date of the latest update: [date].